R3 follows the Vertical Hybrid deployment model that where your R3 solutions run in a secure AWS GovCloud West environment and all of your documents are stored in your Microsoft 365 environment (Commercial, GCC, or GCC High). This architecture helps simplify your CMMC Level 2 certification by ensuring that sensitive data remains entirely within your existing compliant boundary, while also providing your team with the added benefit of working in a familiar, native Office 365 experience that drives productivity and user adoption.
Built on a Secure, Compliant Foundation
R3 CM runs in AWS West GovCloud, a U.S.-only region purpose-built for federal workloads and restricted to U.S. persons. This supports contractors that must meet ITAR, FedRAMP, DoD SRG, and other federal standards when handling sensitive information.
Key security and resiliency measures of R3 CM include:
- CMMC Level 2 alignment: Security controls based on NIST SP 800-171, including granular access control, multi-factor authentication, incident response, audit logging, and continuous monitoring.
- FIPS 140-2 encryption: Data in transit and at rest is encrypted using validated, government-approved algorithms to protect against unauthorized access.
- Redundant backups and disaster recovery: R3 CM ensures business continuity even in the face of disruption, with remote backups and restoration across multiple AWS availability zones to minimize operational risk and data loss.
- Controlled administrative access: AWS GovCloud and R3 staff operations are restricted to U.S. persons and tightly audited to maintain the integrity of your data.
These measures give your organization confidence that your contract management system is operating in an environment specifically designed to meet federal security mandates.
Hybrid Deployment: Full Control Over Your Documents
While many SaaS solutions force you to choose between security and usability, R3 CM offers both through our Hybrid deployment option, which physically and logically separates workflow and metadata from document storage.
With Hybrid deployment, R3 CM stores your workflow and metadata (FCI) in our secure AWS GovCloud platform, while all actual contract documents, including CUI, remain stored in your organization’s Microsoft 365 tenant (Commercial, GCC, or GCC High).
This architecture offers significant compliance and security advantages:
- Your documents remain under your control: All documents, including sensitive files, stay within your own secure Microsoft 365 tenant, governed by your own organization’s access policies, retention schedules, and audit trails.
- Vendor personnel cannot access your documents: Even R3 support staff, administrators, and AWS personnel — though able to see document metadata and workflow links — cannot open or download any document. Attempting to access a document without proper M365 credentials fails, maintaining a strict logical and physical barrier.
- CUI stays within your enclave: This design ensures that CUI and ITAR-controlled materials never leave your authorized compliance boundary, simplifying your organization’s ability to demonstrate adherence to DFARS 252.204-7012, NIST 800-171, and CMMC Level 2 requirements.
- Audit-ready transparency: Auditors can clearly see that sensitive data resides fully within your enclave that is in scope for CUI, while workflow records remain complete and traceable.
By maintaining this separation of duties and environments, R3 CM delivers a level of privacy and compliance protection that traditional SaaS solutions cannot match.
Designed for the Unique Needs of GovCon
Federal contractors face a unique set of pressures when it comes to cybersecurity and compliance. Whether you’re pursuing or maintaining CMMC Level 2 certification, safeguarding CUI, complying with DFARS 252.204-7012 and FAR 52.204-21, or operating under ITAR or export controls, R3 CM’s secure, compliant architecture is specifically built to support your mission.
Some systems force contractors into trade-offs: productivity at the expense of compliance, or security at the expense of usability. With R3 CM, you don’t have to choose. By combining a secure, purpose-built cloud environment with the option to keep sensitive documents fully under your control in your M365 tenant, R3 CM gives your team the tools they need to be productive using Office 365 apps — while meeting the strictest federal standards.
With R3 CM, you gain:
✅ A secure AWS GovCloud platform aligned with CMMC Level 2 and beyond.
✅ FIPS 140-2 validated encryption protecting data in transit and at rest.
✅ Redundant backups and disaster recovery to ensure operational resilience.
✅ Hybrid architecture that keeps sensitive documents entirely within your own Microsoft 365 tenant.
✅ A familiar, Office 365-based user experience that drives adoption and reduces training time.
Click here for more information on our Hybrid Architecture including a full, online Hybrid Architecture Guide for IT and Security.